Rodriguez v. FastMed Urgent Care, Inc., 2025 NCBC 15.
STATE OF NORTH CAROLINA IN THE GENERAL COURT OF JUSTICE SUPERIOR COURT DIVISION
DURHAM COUNTY 24CV008555-310
JACKELYN RODRIGUEZ, Plaintiff,
v.
ORDER AND OPINION ON
DEFENDANT’S MOTION TO DISMISS FASTMED URGENT CARE, INC. f/k/a FASTMED URGENT CARE, P.C.,
Defendant.
THIS MATTER is before the Court on Defendant FastMed Urgent Care, Inc.’s (“FastMed”) Motion to Dismiss (“Motion to Dismiss,” or the “Motion,” ECF No. 14). Having considered the Motion, the parties’ briefs, the arguments of counsel, the applicable law, and all other appropriate matters of record, the Court concludes that the Motion to Dismiss should be DENIED in part and DISMISSED as moot in part for the reasons set forth below.
The Gibbons Law Group, LLC by Philip J. Gibbons and Corey Michael Stanton;
and Stephan Zouras LLC by David J. Cohen, James B. Zouras, Michael Casas, and Teresa M. Becvar for Plaintiff Jackelyn Rodriguez.
Nelson Mullins Riley & Scarborough LLP by Joseph Matthew Gorga, Nathaniel Pencook, and Candace Friel for Defendant FastMed Urgent Care, Inc.
Davis, Judge.
INTRODUCTION
1. In this case, the plaintiff alleges that her medical provider secretly embedded third-party technology on its website that collected and transmitted her confidential information to a third party without her consent. The present Motion requires the Court to address (1) whether North Carolina law imposes upon healthcare providers a common law duty to protect their patients’ private information from unauthorized disclosure; and (2) the pleading requirements for alleging injuries flowing from such conduct.
FACTUAL AND PROCEDURAL BACKGROUND 2. The Court does not make findings of fact in connection with a motion to dismiss under Rule 12(b)(6) of the North Carolina Rules of Civil Procedure and instead recites those facts contained in the complaint and in documents attached to, referred to, or incorporated by reference in the complaint that are relevant to the Court’s determination of the motion. See, e.g., Window World of Baton Rouge, LLC v. Window World, Inc., 2017 NCBC LEXIS 60, at *11 (N.C. Super. Ct. July 12, 2017).
3. At the heart of this lawsuit are two pieces of technology developed by Meta Platforms, Inc. (“Meta”)—the Pixel and the Conversions Application Programming Interface (“CAPI,” and together with the Pixel, the “Business Tools”). (Compl. ¶¶ 13, 19–21.) They were designed—as a part of Meta’s advertising business—to collect data from people who visit websites or open mobile applications (“Users”) and then transmit that data to Meta for analysis. (Compl. ¶¶ 9–10, 25.)
4. Once integrated into a website or server, the Business Tools are “executed in the background,” meaning that they can operate on a website or in a mobile application without ever alerting the User of their presence. (Compl. ¶¶ 15– 16, 39–41.) Further, because of how the Business Tools were designed, they are able to collect, store, and transmit User data in ways that cannot be blocked by traditional “ad blocker” software or by a User refusing to give their consent for their data to be collected. (Compl. ¶¶ 18, 22, 42.)
5. Using the data collected by the Business Tools, Meta is able to connect the User’s data to her “real-world identity” by linking her data to the User’s Facebook account. (Compl. ¶¶ 51–53, 55–56.)1 6. Once Meta has connected the User’s data to her real-world identity, Meta allegedly processes, analyzes, and assimilates the data so that it can be sold to online advertisers. (Compl. ¶¶ 55, 57, 81, 121.)
7. These online advertisers—equipped with personally-identifiable User data—are then able to create marketing campaigns that focus or “target” their advertisements toward specific Users. (Compl. ¶¶ 25, 27, 30–33, 55, 81.)
8. FastMed is an integrated healthcare provider/payer system that is based in Durham County, North Carolina and operates dozens of medical clinics throughout the State. (Compl. ¶ 2.)
9. As part of its business, FastMed operates a publicly available website (the “Website”) and a password-protected patient portal called MyChart (“MyChart,” together with the Website, the “Web Properties”). (Compl. ¶ 2.)
1 The Complaint alleges that if the User does not have a Facebook account, Meta will nonetheless create a “shadow account” to aggregate the User’s data for later identification. (Compl. ¶ 56.)
10. FastMed’s Website allows Users to schedule appointments, locate FastMed providers, and find information on specific health conditions, treatments, and medications. (Compl. ¶ 127.)
11. Through MyChart, FastMed’s patients are able to enter and view a variety of sensitive information, including messages with their healthcare providers, test results, their medications, “health reports,” “medical history,” “plan of care,” health summaries, and billing summaries. (Compl. ¶¶ 44, 125.) MyChart also enables patients to schedule healthcare visits and message their providers directly. (Compl. ¶ 125.)
12. Plaintiff Jackelyn Rodriguez is a resident of North Carolina. (Compl. ¶ 1.) She opened a Facebook account prior to 2009 and has actively maintained it since that time. (Compl. ¶ 1.)
13. Starting around 2015, Plaintiff began seeking medical treatment from FastMed. (Compl. ¶ 1.)
14. As a patient, Plaintiff has used the Web Properties to facilitate her care by messaging her providers, scheduling appointments, finding FastMed office locations, reviewing her medications, viewing doctors’ notes, and searching for information on her various medical conditions and treatments. (Compl. ¶¶ 1, 125.)
15. Plaintiff alleges that after becoming a patient, FastMed surreptitiously integrated the Business Tools into its Web Properties and servers. (Compl. ¶¶ 19, 26, 43, 46–58, 120.)
16. As a result, Plaintiff contends that FastMed—without her knowledge or consent—collected and transmitted her confidential information to Meta, including information regarding her appointments with FastMed providers, her health conditions, and her insurance information. (Compl. ¶¶ 125–30.)
17. In addition, Plaintiff alleges that—unbeknownst to her—Meta and FastMed disclosed her private information to online advertisers. (Compl. ¶¶ 121, 131.) As a result, Plaintiff has been subjected to targeted online advertisements “focused” on her private FastMed patient information. (Compl. ¶¶ 121, 131.)
18. On 25 July 2023, Plaintiff filed a putative class action lawsuit in the United States District Court for the Eastern District of North Carolina against FastMed asserting various claims for monetary relief. See Rodriguez v. FastMed Urgent Care, P.C., 741 F. Supp. 3d 352 (E.D.N.C. 2024).
19. The federal court dismissed the only federal claim asserted in her complaint and declined to exercise supplemental subject matter jurisdiction over her remaining state-law claims. Id.
20. On 24 September 2024, Plaintiff filed the present Complaint in Durham County Superior Court asserting claims for violation of the North Carolina Electronic Surveillance Act (“NCESA”) under N.C.G.S. § 15A-286 along with claims for negligence per se, common law negligence, and invasion of privacy by intrusion upon seclusion. (ECF No. 3.)
21. The Complaint states that Plaintiff seeks to assert her claims against FastMed on behalf of herself and a putative class of “[a]ll residents of North Carolina who used FastMed’s Web Properties and had Private Information about their past, present, or future health conditions shared with Meta without their notice or consent[]” pursuant to Rule 23(a) of the North Carolina Rules of Civil Procedure. (Compl. ¶ 137.)
22. On 5 November 2024, this case was designated as a mandatory complex business case and assigned to the undersigned. (ECF Nos. 1–2.)
23. FastMed filed the present Motion to Dismiss on 9 December 2024 seeking dismissal of all of Plaintiff’s claims.
24. The Court held a hearing on the Motion on 5 March 2025 at which all parties were represented by counsel.
25. Having been fully briefed, the Motion is now ripe for resolution.
LEGAL STANDARD
26. In ruling on a motion to dismiss under Rule 12(b)(6), the Court may only consider the complaint and “any exhibits attached to the complaint,” Krawiec v. Manly, 370 N.C. 602, 606 (2018), in order to determine whether “as a matter of law, the allegations of the complaint, treated as true, are sufficient to state a claim upon which relief can be granted under some recognized legal theory,” Forsyth Mem’l Hosp., Inc. v. Armstrong World Indus., Inc., 336 N.C. 438, 442 (1994) (cleaned up). The Court must view the allegations in the complaint “in the light most favorable to the non-moving party.” Christenbury Eye Ctr., P.A. v. Medflow, Inc., 370 N.C. 1, 5 (2017) (cleaned up).
27. “It is well established that dismissal pursuant to Rule 12(b)(6) is proper when ‘(1) the complaint on its face reveals that no law supports the plaintiff’s claim; (2) the complaint on its face reveals the absence of facts sufficient to make a good claim; or (3) the complaint discloses some fact that necessarily defeats the plaintiff’s claim.’” Corwin v. British Am. Tobacco PLC, 371 N.C. 605, 615 (2018) (quoting Wood v. Guilford Cnty., 355 N.C. 161, 166 (2002)).
ANALYSIS
28. As an initial matter, Plaintiff stated in her brief in response to FastMed’s Motion that she is not proceeding on her claim for violation of the NCESA or her claims for negligence per se or invasion of privacy by intrusion upon seclusion. (Pl.’s Br., ECF No. 19, at 2 n.1.)
29. At the 5 March hearing, Plaintiff’s counsel confirmed that Plaintiff has agreed to voluntarily dismiss those claims with prejudice and that she will be proceeding solely on her claim for common law negligence.
30. Accordingly, the claims in the Complaint for violation of the NCESA, negligence per se, and invasion of privacy by intrusion upon seclusion are DISMISSED with prejudice.
31. Therefore, the only arguments made by FastMed that the Court must address are those dealing with Plaintiff’s claim for common law negligence. I. Existence of a Legal Duty 32. Negligence is defined as the “failure to exercise proper care in the performance of some legal duty which the defendant owed the plaintiff, under the circumstances in which they were placed.” Wood v. Guilford Cnty., 355 N.C. 161, 166 (2002) (cleaned up). “To state a common law negligence claim, plaintiff must show (1) a legal duty; (2) a breach thereof; and (3) injury proximately caused by the breach.” Bridges v. Parrish, 366 N.C. 539, 541 (2013) (cleaned up).
33. In support of its Motion seeking dismissal of Plaintiff’s claim for common law negligence, FastMed asserts that Plaintiff has failed to establish any legal duty that FastMed owed its patients with regard to maintaining the privacy of their health information. In response, Plaintiff contends that our Court of Appeals has expressly recognized such a duty in two cases—Acosta v. Byrum, 180 N.C. App. 562 (2006), and Demarco v. Charlotte-Mecklenburg Hosp. Auth., 268 N.C. App. 334 (2019).
34. This Court addressed this identical issue in Weddle v. WakeMed Health & Hosps., 2023 NCBC LEXIS 162 (N.C. Super. Ct. Dec. 4, 2023).
35. In Weddle, the plaintiffs were current and former patients of the WakeMed Health and Hospitals (“WakeMed”) system. Id. at *3. They alleged that WakeMed had, without their knowledge or consent, embedded Meta’s Pixel technology in its public-facing website and patient portal. Id. at *2–3. As a result, the plaintiffs claimed, WakeMed regularly shared their confidential information with Meta—including their contact information, medical history, and appointment calendar—without their knowledge or consent. Id. at *2.
36. In rejecting WakeMed’s argument that the plaintiffs had failed to allege the existence of a legal duty that had been breached, this Court stated the following:
WakeMed argues that North Carolina law does not recognize a duty of care in these circumstances. Not so. “It is well established that hospitals and doctors in their employ owe their patients a duty to exercise the degree of care that a reasonable person would in similar circumstances to prevent an unreasonable risk of harm to their patients.” Demarco, 268 N.C. App. at 338. Our courts have applied that “general duty of reasonable care” in proper circumstances to the maintenance and dissemination of patient records. Id. at 339; see also Acosta, 180 N.C. App. at 568 (holding that plaintiff had adequately alleged the existence of a “duty to maintain privacy in her confidential medical records”).
...
Nor did the Court of Appeals apply the wrong standard of review in Acosta and Demarco. WakeMed misreads those cases to allow a plaintiff to give “notice of a theory of duty” even if that duty is not one “recognized under the law.” (Br. Supp. 7, ECF No. 60.) But courts do not indulge futile claims. In both cases, the Court of Appeals held that the plaintiffs had stated valid claims for relief and had properly pointed to “HIPAA, its implementing regulations, and hospital privacy policies . . . to plead a specific standard of care sufficient to overcome dismissal under Rule 12(b)(6).” Demarco, 268 N.C. App. at 339; see also Acosta, 180 N.C. App.
at 568. Plaintiffs in this case have done the same.
Weddle, 2023 NCBC LEXIS 162, at *8–9.
37. Thus, in rejecting the same argument FastMed is making here, this Court in Weddle construed Acosta and Demarco as recognizing the very type of duty Plaintiff has alleged in her Complaint.
38. Although FastMed emphasizes the existence of certain differences between the facts of those cases and the facts alleged here, its argument misses the forest for the trees. In both cases, our Court of Appeals unambiguously recognized that healthcare providers owe a general duty of care to patients regarding the maintenance of their confidential information. See Demarco, 268 N.C. App. at 338– 39 (holding that healthcare providers “owe their patients a duty to exercise the degree of care that a reasonable person would in similar circumstances to prevent an unreasonable risk of harm” (cleaned up)); Acosta, 180 N.C. App. at 568 (holding that the plaintiff had sufficiently alleged a duty of care to protect her healthcare information and that “the rules and regulations of the University Health Systems, Roanoke Chowan Hospital, and HIPAA” would inform the standard of care).
39. Moreover, at the 5 March hearing, FastMed’s counsel conceded that Acosta and Demarco are the only cases from North Carolina’s appellate courts that have addressed this issue.
40. The Court fully agrees with the analysis in Weddle regarding the duty of healthcare providers to maintain the confidentiality of their patients’ personal information. As in Weddle, the Complaint filed by Plaintiff here adequately alleges a common law duty existing under North Carolina law and the breach thereof. II. Sufficiency of Allegations of Injury 41. FastMed’s remaining arguments concern the adequacy of Plaintiff’s allegations of injury stemming from its breach and the resulting damages to which she is entitled to recover.
42. In her Complaint, Plaintiff states the following on this subject:
By engaging in the conduct alleged herein, FastMed directly and proximately caused Plaintiff . . . to suffer actual harm and damages that include:
a. a loss in the value of [her] Private Information;
b. embarrassment, humiliation, emotional harm, and distress because of the unauthorized transmission and commercial use of [her] Private Information;
c. being deprived of the full value of healthcare services for which [she] paid, which included a duty to maintain the confidentiality of [her] patient information;
d. being deprived of a proportional share of the value Meta paid Defendant to gain access to [her] Private Information for its commercial use; and
e. being deprived of a proportional share of the value Defendant gained by putting [her] Private Information to its commercial use.
(Compl. ¶ 169.)
43. Broadly speaking, these alleged damages fall into two categories: (1)
emotional distress injury and (2) economic injury. The Court will address each in turn.
A. Emotional Distress 44. As quoted above, Plaintiff describes her emotional distress damages as “embarrassment, humiliation, emotional harm, and distress” resulting from FastMed’s allegedly improper disclosure and use of her personal health-related information.
45. FastMed asserts that such allegations lack sufficient detail under Rule 12(b)(6). However, FastMed fails to cite any North Carolina case law holding that claimed damages for emotional harm stemming from common law negligence must be pled with greater specificity.
46. To the contrary, North Carolina case law makes clear that no heightened pleading requirement exists in this context and that such claims must only meet the low bar of notice pleading. See, e.g., Iadanza v. Harper, 169 N.C. App. 776, 780 (2005) (rejecting an argument that “emotional suffering” resulting from common law negligence must meet a heightened standard of “severe emotional distress”); Royster v. McNamara, 218 N.C. App. 520, 530–33 (2012) (finding allegations that plaintiff “[was] forced to undergo humiliation and emotional damage” to be sufficient in connection with a negligence claim); see also Demarco, 268 N.C. App. at 341–42 (noting that “[a]n allegation of damages is sufficient under Rule 12(b)(6) so long as it provides the defendant notice of the nature and basis of [the] plaintiff’s claim so as to enable him to answer and prepare for trial” (cleaned up)).
47. Therefore, FastMed’s Motion to Dismiss as to Plaintiff’s claim for emotional distress damages is DENIED.
B. Economic Damages 48. With regard to the economic damages referenced in the Complaint, FastMed argues that they are barred by North Carolina’s economic loss rule.
49. “The economic loss rule, as it has developed in North Carolina, generally bars recovery in tort for damages arising out of a breach of contract[.]” Rountree v. Chowan Cnty., 252 N.C. App. 155, 159 (2017) (cleaned up). It “denote[s] limitations on the recovery in tort when a contract exists between the parties that defines the standard of conduct and which the courts believe should set the measure of recovery.” Akzo Nobel Coatings, Inc. v. Rogers, 2011 NCBC LEXIS 42, at *47–48 (N.C. Super. Ct. Nov. 3, 2011).
50. In relying upon the economic loss rule, FastMed asserts that because its entire relationship with Plaintiff was contractual, her economic damages would be recoverable only in connection with a breach of contract claim.
51. However, this Court has previously recognized that the economic loss rule does not bar a tort claim where an independent duty exists under the law that is not premised on an existing contract between the parties.
[T]o avoid the reach of the economic loss rule, “a plaintiff must allege a duty owed to him by the defendant [that is] separate and distinct from any duty owed under a contract.” Akzo Nobel Coatings, Inc., 2011 NCBC LEXIS 42, at *48. As this Court has previously observed, in determining whether the economic loss rule bars a negligence claim, “the true question the Court must answer is whether [the defendant owed the plaintiff] a duty of care to avoid causing [the plaintiff] purely economic loss.” Crescent Univ. CityVenture, LLC v. AP Atl., Inc., 2019 NCBC LEXIS 49, at *42 (N.C. Super. Ct. Aug. 14, 2019).
Johnson Bros. Corp. v. City of Charlotte, 2024 NCBC LEXIS 33, at *7 (N.C. Super. Ct. Feb. 27, 2024).
52. The Court notes that the United States District Court for the Middle District of North Carolina has recently rejected a defendant’s argument seeking application of the economic loss rule under circumstances similar to those existing here. See Williams v. DukeHealth, 2024 U.S. Dist. LEXIS 58377 (M.D.N.C. Mar. 1, 2024).
53. In Williams, the court stated the following:
[T]he Amended Complaint alleges that, in addition to contractual obligations to protect patients’ health data privacy, Defendant had a duty of care to protect Plaintiff’s privacy in her medical records and that HIPAA, among other statutes, informed that standard of care. (Am.
Compl. ¶¶ 33–44, 166–178.) See also Demarco, 268 N.C. App. at 339;
Acosta, 180 N.C. App. at 568; Weddle, 2023 NCBC LEXIS 162, at *4. As mentioned in the discussion of Plaintiff’s breach of contract claim, the extent to which Defendant’s purported duty to Plaintiff arose under a general duty of care, or HIPAA, or the contract exclusively, or neither, will be more appropriately addressed with the development of the record. See Farley v. Eye Care Leaders Holdings, LLC, 2023 U.S. Dist.
LEXIS 15480, at *5 (M.D.N.C. Jan. 31, 2023) (unpublished) (plaintiffs “met the minimal standard of plausibility for each of their claims” in data breach case and “[a]ny weaknesses of those claims will be better evaluated on a more developed factual record”). At this stage, at least, Plaintiff has plausibly alleged under North Carolina law that Defendant owed a duty of care apart from or in addition to its contractual obligations. Therefore, Defendant’s motion to dismiss the negligence claim should be denied. See generally Weddle, 2023 NCBC LEXIS 162, at *2–3.
Williams, 2024 U.S. Dist. LEXIS 58377, at *29–31.
54. This Court finds the analysis in Williams to be persuasive. Here too, the Court has found that Plaintiff sufficiently pled the existence of a common law legal duty of care owed by FastMed to protect her private information that is not dependent on any existing contractual duty between the parties.
55. Nevertheless, FastMed argues that even if the economic loss rule does not require dismissal of this action in its entirety, it should at least bar Plaintiff from recovering her claimed economic damages because that category of damages (unlike her emotional distress injuries) arises solely from her contractual relationship with FastMed.
56. The Court concludes that this argument is premature for two reasons.
57. First, Plaintiff has not alleged the existence of a specific contract between herself and FastMed. Moreover, even assuming such a contractual relationship could be inferred generally from the allegations in the Complaint, further factual development—through discovery—would be necessary to define the contours of that relationship, particularly as it relates to Plaintiff’s claimed economic damages. See, e.g., Greentouch USA, Inc. v. Lowe’s Cos. Inc., 2024 NCBC LEXIS 132, at *13–14 (N.C. Super. Ct. Oct. 2, 2024) (concluding that “dismissal . . . under the economic loss doctrine would be premature” in light of “the limited information before the Court at this early stage of the action”); Club Car, Inc. v. Dow Chem. Co., 2007 NCBC LEXIS 10, at *28–31 (N.C. Super. Ct. May 3, 2007) (deferring consideration as to the possible application of the economic loss rule where it was “unclear whether [plaintiff] ha[d] a contractual remedy”).
58. Second, the parties have not expressly briefed the issue of whether North Carolina law permits the application of the economic loss rule so as to bar some (but not all) categories of damages sought by a plaintiff where the doctrine would not serve to bar the entire cause of action.
59. For these reasons, the Court declines to apply the economic loss rule to any aspect of Plaintiff’s claims at the present time without prejudice to FastMed’s ability to reassert this argument at a later stage of this litigation.
CONCLUSION
THEREFORE, IT IS ORDERED as follows:
1. FastMed’s Motion to Dismiss as to Plaintiff’s claim for violation of the NCESA and her claims for negligence per se and invasion of privacy by intrusion upon seclusion is DISMISSED as moot, and those claims are DISMISSED with prejudice; and 2. In all other respects, FastMed’s Motion to Dismiss is DENIED.
SO ORDERED, this the 25th day of March 2025.
/s/ Mark A. Davis
Mark A. Davis
Special Superior Court Judge for Complex Business Cases